Re: [ovirt-users] engine randomly updated 1 package on all my hosts overnight

[Charles Kozler]

Yedidyah - yes, update would be best of course. I've had this HIDS running
for a little over a year or so and never saw this before so was a little
weary

On Sun, Sep 17, 2017 at 3:00 AM, Yedidyah Bar David  wrote:

> On Fri, Sep 15, 2017 at 5:12 PM, Charles Kozler 
> wrote:
> > Hello -
> >
> > Can anyone just briefly tell me if this is expected behavior or not?
> >
> > I know you can tell the engine to update hosts, but nobody was using the
> > engine and I see the engine logging in and the yum command being run so
> I am
> > curious if this is expected or not?
>
> It is, unless you have otopi-1.6.2 or later:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1405838
>
> >
> > On Thu, Sep 14, 2017 at 10:54 AM, Charles Kozler 
> > wrote:
> >>
> >> I received an alert from OSSEC HIDS that a package was installed at
> 00:59.
> >> Nobody uses this infrastructure but me
> >>
> >> Upon investigation I find this
> >>
> >> Sep 14 00:59:18 ovirthost1 sshd[93263]: Accepted publickey for root from
> >> 10.0.16.50 port 50197 ssh2: RSA
> >> 1c:fc:0d:b8:40:2c:bf:87:f7:8f:b2:52:0b:c4:f6:4d
> >> Sep 14 00:59:18 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
> >> opened for user root by (uid=0)
> >> Sep 14 00:59:46 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
> >> closed for user root
> >>
> >> 10.0.16.50 is my ovirt engine
> >>
> >> And the yum log
> >>
> >> Sep 14 00:59:28 Updated: iproute-3.10.0-87.el7.x86_64
> >>
> >> However, what is baffling to me is that this is a cluster I setup about
> 9
> >> months ago and have not updated at all (its a testing env for VM
> systems)
> >>
> >> Why would ovirt seemingly randomly update and install a package? I know
> >> the engine checks for updates on hosts but this is the first time in my
> time
> >> using ovirt that ovirt instructed a host to install a package. This
> occurred
> >> on all of my ovirt nodes in this infrastructure (3)
>
> Probably the reason this didn't happen before is a mere coincidence -
> there are not many updates to 'iproute', or you did update it manually
> in other cases, or something like that.
>
> >>
> >> ovirt Version 4.0.1.1-1.el7.centos
>
> Most likely you have otopi-1.5.2, which does not have above bug fixed.
>
> You might consider upgrading to oVirt 4.1.
>
> Best,
> --
> Didi
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] engine randomly updated 1 package on all my hosts overnight

[Charles Kozler]

Thanks for confirming

On Sun, Sep 17, 2017 at 11:05 AM, Christopher Cox 
wrote:

> On 09/17/2017 02:00 AM, Yedidyah Bar David wrote:
>
>> On Fri, Sep 15, 2017 at 5:12 PM, Charles Kozler 
>> wrote:
>>
>>> Hello -
>>>
>>> Can anyone just briefly tell me if this is expected behavior or not?
>>>
>>> I know you can tell the engine to update hosts, but nobody was using the
>>> engine and I see the engine logging in and the yum command being run so
>>> I am
>>> curious if this is expected or not?
>>>
>>
> My iproute mysteriously updated as well.
>
> ___
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] engine randomly updated 1 package on all my hosts overnight

[Christopher Cox]

On 09/17/2017 02:00 AM, Yedidyah Bar David wrote:

On Fri, Sep 15, 2017 at 5:12 PM, Charles Kozler  wrote:

Hello -

Can anyone just briefly tell me if this is expected behavior or not?

I know you can tell the engine to update hosts, but nobody was using the
engine and I see the engine logging in and the yum command being run so I am
curious if this is expected or not?


My iproute mysteriously updated as well.

___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] engine randomly updated 1 package on all my hosts overnight

[Yedidyah Bar David]

On Fri, Sep 15, 2017 at 5:12 PM, Charles Kozler  wrote:
> Hello -
>
> Can anyone just briefly tell me if this is expected behavior or not?
>
> I know you can tell the engine to update hosts, but nobody was using the
> engine and I see the engine logging in and the yum command being run so I am
> curious if this is expected or not?

It is, unless you have otopi-1.6.2 or later:

https://bugzilla.redhat.com/show_bug.cgi?id=1405838

>
> On Thu, Sep 14, 2017 at 10:54 AM, Charles Kozler 
> wrote:
>>
>> I received an alert from OSSEC HIDS that a package was installed at 00:59.
>> Nobody uses this infrastructure but me
>>
>> Upon investigation I find this
>>
>> Sep 14 00:59:18 ovirthost1 sshd[93263]: Accepted publickey for root from
>> 10.0.16.50 port 50197 ssh2: RSA
>> 1c:fc:0d:b8:40:2c:bf:87:f7:8f:b2:52:0b:c4:f6:4d
>> Sep 14 00:59:18 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
>> opened for user root by (uid=0)
>> Sep 14 00:59:46 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
>> closed for user root
>>
>> 10.0.16.50 is my ovirt engine
>>
>> And the yum log
>>
>> Sep 14 00:59:28 Updated: iproute-3.10.0-87.el7.x86_64
>>
>> However, what is baffling to me is that this is a cluster I setup about 9
>> months ago and have not updated at all (its a testing env for VM systems)
>>
>> Why would ovirt seemingly randomly update and install a package? I know
>> the engine checks for updates on hosts but this is the first time in my time
>> using ovirt that ovirt instructed a host to install a package. This occurred
>> on all of my ovirt nodes in this infrastructure (3)

Probably the reason this didn't happen before is a mere coincidence -
there are not many updates to 'iproute', or you did update it manually
in other cases, or something like that.

>>
>> ovirt Version 4.0.1.1-1.el7.centos

Most likely you have otopi-1.5.2, which does not have above bug fixed.

You might consider upgrading to oVirt 4.1.

Best,
-- 
Didi
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Re: [ovirt-users] engine randomly updated 1 package on all my hosts overnight

[Charles Kozler]

Hello -

Can anyone just briefly tell me if this is expected behavior or not?

I know you can tell the engine to update hosts, but nobody was using the
engine and I see the engine logging in and the yum command being run so I
am curious if this is expected or not?

On Thu, Sep 14, 2017 at 10:54 AM, Charles Kozler 
wrote:

> I received an alert from OSSEC HIDS that a package was installed at 00:59.
> Nobody uses this infrastructure but me
>
> Upon investigation I find this
>
> Sep 14 00:59:18 ovirthost1 sshd[93263]: Accepted publickey for root from
> 10.0.16.50 port 50197 ssh2: RSA 1c:fc:0d:b8:40:2c:bf:87:f7:8f:
> b2:52:0b:c4:f6:4d
> Sep 14 00:59:18 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
> opened for user root by (uid=0)
> Sep 14 00:59:46 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
> closed for user root
>
> 10.0.16.50 is my ovirt engine
>
> And the yum log
>
> Sep 14 00:59:28 Updated: iproute-3.10.0-87.el7.x86_64
>
> However, what is baffling to me is that this is a cluster I setup about 9
> months ago and have not updated at all (its a testing env for VM systems)
>
> Why would ovirt seemingly randomly update and install a package? I know
> the engine checks for updates on hosts but this is the first time in my
> time using ovirt that ovirt instructed a host to install a package. This
> occurred on all of my ovirt nodes in this infrastructure (3)
>
> ovirt Version 4.0.1.1-1.el7.centos
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

[ovirt-users] engine randomly updated 1 package on all my hosts overnight

[Charles Kozler]

I received an alert from OSSEC HIDS that a package was installed at 00:59.
Nobody uses this infrastructure but me

Upon investigation I find this

Sep 14 00:59:18 ovirthost1 sshd[93263]: Accepted publickey for root from
10.0.16.50 port 50197 ssh2: RSA
1c:fc:0d:b8:40:2c:bf:87:f7:8f:b2:52:0b:c4:f6:4d
Sep 14 00:59:18 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
opened for user root by (uid=0)
Sep 14 00:59:46 ovirthost1 sshd[93263]: pam_unix(sshd:session): session
closed for user root

10.0.16.50 is my ovirt engine

And the yum log

Sep 14 00:59:28 Updated: iproute-3.10.0-87.el7.x86_64

However, what is baffling to me is that this is a cluster I setup about 9
months ago and have not updated at all (its a testing env for VM systems)

Why would ovirt seemingly randomly update and install a package? I know the
engine checks for updates on hosts but this is the first time in my time
using ovirt that ovirt instructed a host to install a package. This
occurred on all of my ovirt nodes in this infrastructure (3)

ovirt Version 4.0.1.1-1.el7.centos
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users